text: Ok, encontrei a resposta: CURLOPT_HTTPHEADER em vez de CURLOPT_HEADER.
  O código final e funcionando:
  if (extension_loaded('curl') === true) {
      $ch = curl_init();
      curl_setopt($ch, CURLOPT_URL, $url);
      curl_setopt($ch, CURLOPT_USERAGENT, &quot;Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36&quot;);
      curl_setopt($ch, CURLOPT_HTTPHEADER, array('Authorization: Bearer xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'));
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
      curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
      curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // remover em produção
      curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE); // remover em produção
      
      $data = curl_exec($ch);     
      if(curl_exec($ch) === false) {
          curl_close($ch);
          $err = 'Curl erro: ' . curl_error($ch);         
          echo $data;
      }
      else {
          curl_close($ch); 
          $json = json_decode($data, true);
          echo 'Title: '. $json['name'] .'&lt;br&gt;';
          echo 'Price: '. $json['id'] .'&lt;br&gt;';
          print(&quot;&lt;pre&gt;&quot;.print_r($data,true).&quot;&lt;/pre&gt;&quot;); // DEBUG
      }   
  }